F5 BIG-IP Remote Code Execution Vulnerability

F5 BIG-IP Remote Code Execution Vulnerability

Release Date: 23 Sep 2026

A vulnerability was identified in F5 BIG-IP. A remote attacker could exploit this vulnerability to trigger remote code execution on the targeted system.

 

Note:

CVE-2026-94127  is being exploited in the wild. This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Hence, the risk level is rated as High Risk.

---

Impact

• Remote Code Execution

---

System / Technologies affected

BIG-IP APM

 

• Versions 17.1.0 - 17.1.3
• Versions 17.5.0 - 17.5.1
• Versions 21.1.0

 

---

Solutions

Please visit the vendor web-site for more details.

 

Apply workarounds issued by the vendor:

• https://my.f5.com/manage/s/article/K000162605

---

Vulnerability Identifier

• CVE-2026-94127

---

Source

• F5

---

Related Link

• https://my.f5.com/manage/s/article/K000162605